Principal Engineer
Federal Platform Architecture & Compliance Automation
Senior individual contributor with 15+ years building platform-grade tooling and automation for classified and heavily-regulated environments. Career-long pattern of being elevated into bespoke or expanded-scope roles at HP, Cisco, and Zscaler — recognized for filling operational gaps that off-the-shelf products and assigned engineering resources do not cover. Author of 10+ self-built solutions across that span, including two integrated platforms: an internal proactive support and observability platform at Cisco (covering classified federal customer environments) and a plugin-based government operations platform at Zscaler running in AWS GovCloud across FedRAMP Moderate, FedRAMP High, DoD IL5, and DoD IL6 — with all AI inference contained within EC2 to meet Federal data-handling requirements. Deep working fluency in Federal compliance frameworks (FedRAMP, DoD Impact Levels, DISA STIG, FIPS 140, NIST 800-53), the full Zscaler product surface, and the operational realities of supporting U.S. National Security customers at scale.
Work Experience
GovCloud Deployment Specialist · Principal Technical Success Manager
Hired by the Director of Customer Success under the offer-letter title GovCloud Deployment Specialist — a role established to extend National Security-vertical-grade engineering care across all of Public Sector Customer Success (HR title consolidated to Principal Technical Success Manager). Three concurrent functions:
- Technical Success Management — own technical success for a Fortune 500 aerospace and defense manufacturer (~$1.8M ARR, 40K+ users) and a major international financial institution; primary technical point of contact for configuration guidance, architecture review, and escalation triage.
- Escalation Engineering — retained as the sole escalation point of contact for Zscaler's entire U.S. National Security portfolio: five cabinet-level departments (Defense, Homeland Security, Energy, Justice, State) and 122 total accounts including their component agencies, supporting approximately 3.2 million end users.
- Platform & Automation Engineering — solo-designed and built a plugin-based government operations platform running in AWS GovCloud across FedRAMP Moderate, FedRAMP High, DoD IL5, and DoD IL6 — currently the only automated operational tooling capability available in those compliance tiers.
- Hardened to DISA STIG and FIPS 140 baselines on RHEL 9, with NIST 800-53 control mapping at the source-file level, SSP authored alongside the code, hash-chained tamper-resistant audit logging, FIPS-validated cryptography (no exceptions), and a signed release pipeline gated by SAST, SCA, and manual security review.
- Plugin catalog includes an AI assistant with all model inference inside the EC2 boundary; a log analysis plugin that cut root-cause analysis on a key telemetry stream from about a week to minutes; secure file transfer; system auditing; AI-assisted code review; and data obfuscation.
- Built the supporting AWS GovCloud DevSecOps environment from scratch — vulnerability scanning, compliance auditor workflows, SIEM, and private GitLab — now positioned as the framework for future Federal tooling at Zscaler.
- Authored and delivered to leadership two formal compliance artifacts: a FedRAMP Compliance Assessment mapping day-to-day Public Sector support workflows against the ZIA/ZPA GOV High SSPs (seven findings with NIST 800-53 control implications and a phased remediation roadmap) and a Public Sector Operational Risk and Execution Assessment documenting systemic execution gaps and recommending a controlled-tooling operating model.
- Initiative began as self-directed; now formally recognized and supported by leadership.
Principal Escalation Engineer
Position created for and exclusively held by this engineer — first and only Principal Escalation Engineer in Zscaler's history, recruited directly by the Area Director for the National Security vertical on the strength of the CISA residency.
- Sole escalation point of contact for Zscaler's entire U.S. National Security portfolio — five cabinet-level departments and 122 total accounts, supporting approximately 3.2 million end users; a key stakeholder in every significant issue, bug, incident, and leadership engagement in the vertical.
- Escalation point in every direction — customer, account team, sales, support, engineering, development, and compliance; drove resolution of complex multi-team escalations, advanced troubleshooting, Jira-tracked bug management, and cross-business-unit escalation paths.
- Loaned to the Customer Success organization for a year-long Critical Accounts Program engagement — Zscaler's highest escalation tier, reserved for at-risk accounts — with a Fortune 500 aerospace and defense manufacturer, while maintaining escalation coverage across the vertical; the account was retained and remains under this engineer's care today.
- Elevated the PowerShell module library originated at CISA into an official Zscaler tool covering the full API surface (ZIA, ZPA, ZDX, and supporting products) — chosen because PowerShell is STIG-approved and deployable where Python and other tooling cannot be installed; in active use and maintenance roughly two years on, distributed to Federal customers as needed.
- Developed custom monitoring scripts for legacy branch connectors when official health monitoring proved inadequate.
- Served as informal peer mentor across engineering and customer-facing teams — escalation point for technical guidance and customer-communication coaching.
Resident Engineer (Professional Services)
Embedded full-time at the Cybersecurity and Infrastructure Security Agency (CISA) under DHS — operating with access to both agency and Zscaler systems, supporting arguably Zscaler's most security-conscious customer and one of its most hardened, complex environments.
- Helped build the agency's entire Zscaler environment: app connector deployment, NSS server buildout with Splunk log ingestion, Private Service Edge deployment, and ZIA policy configuration — on the customer's timeline, with progress reporting back to Zscaler.
- Built a PowerShell module suite for the Zscaler APIs that the agency still uses today, integrated into their Terraform workflows and custom monitoring.
- Originated what later became Zscaler's primary government-environment log analyzer as a personal workstation script to address a Public Sector tooling gap.
- Built a PowerShell + Selenium-driven Salesforce reporting automation producing a recurring "Weekly Account Review" used by the National Security account team — still in active production use.
- Day-to-day work spanned best-practices advisement, custom automation, ticket management, enhancement-request filing, meeting orchestration, and direct customer trainings — with a reputation for clearing internal obstacles in pursuit of customer resolution.
Network Security Engineer
Sole network and security engineer — ~200 employees, 2 datacenters, 10 sites — reporting directly to the CTO, alongside one database engineer. Three years of sustained modernization bringing infrastructure up to pace with rapid company growth.
- Stood up greenfield monitoring and security infrastructure: Splunk (migrating off LogRhythm), Zscaler (ZIA and ZPA), SilverPeak SD-WAN — including full Zscaler/SilverPeak integration for direct-to-cloud security at every site — and SolarWinds as the organization's first network monitoring solution.
- Led multi-platform modernization: Hyper-V → Nutanix migration, F5 load balancer replacement with current-generation models, and a Ruckus wireless rollout across all sites with per-environment RF tuning.
- Designed an integrated automation framework spanning Splunk, SolarWinds, and Lansweeper enabling non-technical help-desk staff to safely execute production maintenance — drain, suppress alerts, health-check, promote, resume monitoring.
- Extended the framework with bespoke services such as a centralized print-management web application feeding SolarWinds and Splunk.
- Implemented advanced threat detection, stronger authentication practices, proactive monitoring, full device lifecycle management, and complete estate documentation.
Senior Network Engineer
Engineer/architect-for-hire in the Professional Services arm of a regional ISP / MSP — customer-site design, implementation, and incident work across the U.S. East Coast, spanning week-long enterprise projects to same-day emergency engagements.
- Won and delivered a full wireless implementation at the Greensboro Coliseum (60,000+ attendee capacity) as a two-person team — Ekahau site survey with a cart-mounted mobile access point to map coverage weaknesses and simulate the proposed design, then the winning bid and the end-to-end install: access points, switching, firewalls, and VPN.
- Delivered a Cisco ACI datacenter migration on-site at Ahold Delhaize — moving an aging mixed-Nexus estate to fully automated ACI fabric with leaf switching supporting true 802.1x endpoint authentication.
- Pre-staged ~30 Palo Alto firewalls for Coca-Cola with API-automated configuration, pre-attached to Panorama and documented so on-site IT could complete deployment by swapping cables — a one-week engagement.
- Executed an aggressive four-week VeloCloud SD-WAN rollout across Nucor Steel offices in every northeastern state — travel, overnight install inline with existing Palo Alto firewalls, next-morning verification with staff on site, then on to the next state.
- Emergency incident response for a paper manufacturer with a malware infestation that had taken much of the plant offline — in a single evening, cleaned the infected production-floor industrial machines, installed a firewall (the site had none), and stood up DNS-layer security via OpenDNS.
- Same-day resolution of a food-manufacturing plant outage caused by pfSense gateway-monitoring misconfiguration — the customer later sought out this engineer by name for follow-on work.
- Designed the wireless infrastructure for a major tobacco manufacturer in the Triad area — architecture and design delivered as a standalone work product, with implementation handed off to another engineer due to concurrent project commitments.
- Dozens of short consulting, design, and implementation engagements between anchor projects: firewall migrations, switching upgrades, hardening, vulnerability assessments, and camera systems.
Network and Security Architect
Sole network and security engineer (~400 employees, single site with in-building datacenter). Walked into infrastructure that had not kept pace with company growth — Graylog as the only monitoring, no firewall HA, a 100Mb-backbone core, consumer-grade access points, and an unstandardized Hyper-V/VMware virtualization mix — and drove a self-proposed, CISO-sponsored modernization program.
- Authored the problem inventory and phased modernization proposal, then established the evidence base first: SolarWinds and Splunk standup surfaced that the entire network ran on a 100Mb backbone and that the existing Graylog deployment was silently dropping logs from the forwarding pipeline; phpIPAM replaced a perpetually file-locked spreadsheet on a share drive as the IP source of truth.
- Replaced the Cisco 6500 core with Nexus 9300 switching over several weeks of night work — mapped legacy port configurations, re-cabled the building from Cat5 to Cat6, and executed the migration in deliberately cautious stages to guarantee zero business-hours impact.
- Replaced a single Cisco ASA 5505 with an HA pair of rackmount Meraki firewalls, unlocking the 3Gb fiber circuit the company was already paying for but had been bottlenecking to 100Mb — cutover completed overnight with the improvement immediately and unprompted noticed by the executive team the next morning.
- Rolled out centrally managed Meraki wireless replacing standalone consumer-grade access points, plus Meraki IP cameras, badge readers, print management, and switch-management cleanup — night-shift execution tracked transparently against a shared team worklist.
- Conducted vulnerability assessments, compliance audits, incident investigations, and security proof-of-concept evaluations throughout.
Platform Architect · Platform Engineer · Senior Customer Support Engineer · CIN Agent
CNS provides support for classified customer environments where standard TAC cannot engage directly — work requiring active Secret and TS/SCI clearances. Entered as a front-line call-intake agent; left as the Platform Architect leading the team responsible for tooling infrastructure across all Secret and Top Secret customer enclaves.
- As a CIN agent — first point of contact for inbound classified-customer calls — identified that manual entitlement validation (mapping a device serial to a valid contract) consumed up to 15 minutes per call. Wrote a lookup tool that cross-referenced serial-to-contract and caller-to-contract authorization in seconds, eliminating the hold entirely.
- Expanded the same tool into one-click RMA dispatch: with roughly 60% of inbound cases being RMAs and entitlement data already captured, the agent could create and dispatch the RMA immediately — cutting dispatch from ~30 minutes to ~5 against 4-hour replacement SLAs, directly reducing SLA violations and the penalty payouts attached to them.
- Recruited onto the platform team on the strength of that work, chartered to build and maintain a consistent, hardened tooling infrastructure across all Secret and Top Secret customer environments — at the time, a single poorly-configured ScienceLogic EM7 deployment.
- Authored EM7 PowerPacks extending monitoring coverage to 90% of Cisco's product portfolio (the corporate coverage target), and built an unclassified CNS lab environment — modeled on Cisco's CALO — to prove capability against real devices and give CSEs a space for customer-issue recreates outside classified boundaries.
- As gaps surfaced in EM7, grew the stack to include Splunk, Nessus, SolarWinds, and Zenoss — the net result a STIG-compliant, fully documented monitoring suite adopted internally as "Cisco Overwatch."
- Overwatch capabilities included a single-pane-of-glass dashboard designed on a newspaper-front-page model, smart call-home integration, automated ticket spawning, Splunk-driven dashboards and reporting, software image validation, vulnerability remediation, and proactive configuration checks — shifting CNS from reactive to proactive support, often owning incidents before customers were aware of them.
- Promoted to Platform Engineer within nine months of joining the three-person platform team, then to Platform Architect on taking over the team; led it through departure while continuing to build supporting tooling, from custom traffic generators to malware-sample generation suites for issue reproduction.
- Rebuilt and sanitized customer configurations to scrub classified data prior to TAC handoff, enabling problem reproduction without compromising confidentiality.
Network Automation Engineer · Remote Support Engineer
First civilian role after the Air Force. Started on the remote-support phones; moved onto the DMVPN refresh team within months specifically on the strength of self-initiated automation work.
- Remotely supported USPS field technicians through installs of routers, switches, and access points; self-initiated automation of device configuration and equipment onboarding, cutting per-case hold time from roughly 30 minutes to under 5 — adopted by management as the team-wide process.
- Brought onto the DMVPN team on the strength of that work to apply the same treatment to the nationwide Cisco 871 → 891 router refresh across 6,800 post offices.
- Built the automation on Ubuntu with Ansible and Python — in 2014, before Ansible was widely adopted — generating DMVPN configs from a linked site database, replacing hand-built configs with self-service pulls anyone on the team could run.
- Built a benchtop provisioning station: place a router on the bench with a console connection and it applied the site config, printed the installation instructions and the shipping label in one pass — under a minute per router — then updated the tracking number in the database and sent the postmaster an automated email with the digital instructions and return-shipping steps for the old equipment.
- The printed instructions enabled postmasters to complete installs end-to-end without an on-site technician — eliminating truck-roll travel costs across the refresh.
- Combined effect: throughput went from 4–6 routers per day — bottlenecked on config builds and phone-guided installs — to the entire remaining backlog cleared in a single week by a four-person team.
- After completing primary contract scope ahead of schedule, self-initiated supplementary work including a TACACS+ deployment.
Cyber Transport (2E2X1 → 3D1X2) · Cryptography Technician
Routing, switching, and cryptographic systems engineer in expeditionary combat communications — trained at Keesler AFB, MS; served with the 31st CBCS at Tinker AFB, transferring to the 5th Combat Communications Group at Robins AFB upon the 3rd Group's inactivation. Responsible for standing up complete forward-operating-base infrastructure: tactical networks and cryptographic systems plus the power generation, HVAC, and satellite transport they depend on. Honorable discharge.
- Forward deployed three times (~18 months in theater) in support of the Counter Terrorism Joint Task Force – Horn of Africa (CTJTF-HOA), operating in Kenya, Somalia, Ethiopia, Uganda, and Djibouti in support of tactical teams from federal investigative, intelligence, and law-enforcement agencies.
- Frequently the sole Air Force member on joint 3–5 person teams alongside Marine, Army, and Navy operators; field SME for computer, network, cryptographic, and radio systems.
- Appointed squadron Vehicle Control Officer — accountable for a 27-vehicle fleet valued at $16M, spanning readiness, maintenance scheduling, and operator qualification, held alongside primary network duties.
- End-to-end expeditionary logistics beyond the core specialty: certified on the 10K all-terrain forklift for building and loading air-cargo pallets of squadron communications equipment, and deployed generators and environmental control units to establish forward operating bases.
- Designed and delivered hands-on network training for fellow airmen using a progressive live-lab methodology — starting from two LAN-connected game consoles and incrementally inserting switches, routers, firewalls, TACLANE encryptors, microwave links, and a REDCOM-switched VoIP path, requiring trainees to restore connectivity at each layer of the OSI model — an approach that produced consistently stronger retention than classroom-first instruction.
- Built a console-based configuration automation script that reduced per-device provisioning from hours to minutes; reorganized chalk staging to cut deployment turnaround from 48 to under 24 hours — practice adopted group-wide.
- Maintained COMSEC equipment including secure key destruction and rekeying of TACLANE encryption devices; granted TS/SCI during this tenure.
- Awarded two Air Force Commendation Medals.
Skills
Federal Compliance & Security Frameworks
FedRAMP Moderate / High · DoD IL5 / IL6 · DISA STIG · CIS Benchmarks (OpenSCAP-validated) · FIPS 140 · NIST 800-53 (source-level control mapping) · SSP authoring · ATO / continuous monitoring workflows
AI & Agentic Engineering
LLM platform integration (Anthropic Claude API, local Ollama inference) · in-boundary AI inference in AWS GovCloud EC2 · Model Context Protocol (MCP) server design — custom tool fleet spanning network, identity, observability, and virtualization domains · agentic operations with Claude Code · AI-assisted code review & log analysis
Cloud & Infrastructure as Code
AWS (GovCloud + commercial) · EC2 · IAM Identity Center / SSO · GovCloud DevSecOps environment buildout · Packer (CIS-hardened golden-image pipelines) · Ansible (control-plane at scale) · Docker · Traefik
Zscaler Platform (full surface)
ZIA · ZPA · ZDX · ZCC · Zscaler API (full coverage) · ZIA/ZPA/ZDX Certified Administrator
Networking & Security Platforms
Cisco (ISR, ASA, Nexus, FlexPod, Prime, CNS) · Palo Alto · Meraki · Juniper · F5 · pfSense (HA/CARP) · Ubiquiti UniFi · Ruckus · SilverPeak & VeloCloud SD-WAN · DMVPN · ISE · TACACS+ · PowerDNS · Kea DHCP
Identity, Secrets & PKI
Authentik (SAML / OIDC SSO) · HashiCorp Vault (HA raft, auto-unseal) · Vaultwarden · step-ca private PKI · break-glass access design · secrets-reference pipelines
Monitoring, Observability & SIEM
Splunk (admin + dashboards) · SolarWinds (NPM, SAM, syslog) · Zabbix · Wazuh · Uptime Kuma · NetBox (DCIM / IPAM source of truth) · Zenoss · ScienceLogic EM7 · Tenable · LogRhythm
Automation, Development & DevSecOps
PowerShell (full module authoring) · Python · Bash · Ansible · Selenium · GitLab (private hosted, CI/CD) · signed release pipelines · SAST / SCA integration · plugin SDK design · systemd hardening
Cryptography & Classified Systems
TACLANE encryption devices · COMSEC maintenance and key management · TS/SCI-cleared work history
Virtualization, Backup & Operating Systems
VMware ESXi / vCenter (template lifecycle, snapshot discipline) · Veeam (backup design, DR runbooks) · Nutanix · Hyper-V · RHEL 9 (DISA STIG hardened, SELinux enforcing, FIPS-enabled) · Ubuntu Server (CIS-L1) · Windows Server
Engineering Practice
Greenfield platform standup · multi-vendor migrations · vulnerability assessment & remediation · penetration testing · incident response & RCA · cross-BU technical escalation · peer mentorship
Education
Bachelor's, Network Operations and Security
Western Governors University · January 2019 – August 2022
Electronic Systems Technology — Network Infrastructure
Community College of the Air Force · 2009
Certifications
- Zscaler ZDX Certified Administrator (ZCCA-ZDX) — 2023
- Zscaler ZIA Certified Administrator (ZCCA-IA) — 2023
- Zscaler ZPA Certified Administrator (ZCCA-PA) — 2023
- SolarWinds Certified Professional — 2022
- Splunk Certified Administrator — 2020
- Cisco Security Ninja Black Belt — 2015 (15th recipient company-wide)
- Cisco CCNA Security — 2015
- Cisco CCNA Routing & Switching — 2015
- CompTIA Security+ — 2010
Military Awards
Air Force Commendation Medal (×2)